Privacy Policy

This Privacy Policy explains how Cracy Platform ("Cracy", "we", "our", or "us") collects, uses, processes, stores, shares, and protects your information when you access or use the Cracy mobile application, website, and related services (collectively, the "Platform").

By accessing or using Cracy, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy. If you do not agree, please do not use the Platform.

1. What This Privacy Policy Is and What It Covers

Effective Date: 16 December 2025

This Privacy Policy explains what information Cracy collects, why it is collected, how it is processed, how it may be shared, how long it is retained, and what choices you have.

This Policy applies to all features, products, technologies, software, content formats, campaigns, votes, communities, messaging systems, analytics, moderation systems, and future services operated by Cracy (collectively, the "Platform").

This Privacy Policy must be read together with Cracy's Terms of Service, Community Guidelines, and Content Moderation Policies. All documents operate in a self-reinforcing loop, and no document shall be interpreted independently in a manner that increases Cracy's liability.

By using Cracy, you confirm that you understand that Cracy is a technology intermediary and public-first platform, and that your use of the Platform is entirely voluntary and at your own risk.

2. Information We Collect

The information we collect depends on how you use Cracy. Different features require different data. Some information is mandatory for the Platform to function; other information is optional and affects experience quality.

2.1 Information You Provide

This may include:

• Name, email address, username, date of birth, and optional profile details (such as sexual orientation)
• Profile data (photo, bio, links, preferences)
• Content you create or share (posts, videos, images, captions, comments, campaigns, votes)
• Messages and communications
• Reports, feedback, or support requests

You are solely responsible for ensuring that any information you provide is lawful, accurate, and does not violate third-party rights.

2.2 Sensitive Personal Data

We may collect certain sensitive personal information that users voluntarily provide, including:

• Date of birth (used for age verification, eligibility, and age-appropriate experience)
• Sexual orientation (only if voluntarily provided in profile or content)

We handle this data with additional care:

• Collected only when explicitly provided by the user
• Used solely for personalization and improving user experience
• Not used for advertising profiling or sold to third parties
• Can be updated or deleted by the user at any time

2.3 Media Access and Usage

Cracy may request access to your device's camera and photo library.

• Camera Access: Used only when you choose to record videos or capture photos for posts or campaigns.
• Photo Library Access: Used only when you choose to select and upload photos or videos from your device.

Any media you upload may be stored on our servers and shared with other users through your activity on the platform.

We do not access or collect media without your explicit action.

Camera and Microphone Usage

Cracy uses the device camera to allow users to capture photos and videos for posting content within the app.

The microphone is used when recording videos to capture audio.

These permissions are only activated when the user initiates content creation and are not used in the background.

The app does not access the camera or microphone without user interaction.

2.4 Automatically Collected Information

We automatically collect:

• Device and software data
• Usage, interaction, and engagement metrics
• Log data, IP address, timestamps
• Diagnostics, crash reports, and performance data

2.5 De-identified, Aggregated, and Anonymised Data

In many cases, information is aggregated, anonymised, or de-identified before use. Such information is treated as non-personal data and may be used without restriction.

Cracy does not attempt to re-identify anonymised data.

2.2 Information Collected Automatically

When you use Cracy, we automatically collect certain information, including:

• Device Information: device type, OS, app version, unique device identifiers
• Usage Data: interactions, views, votes, campaigns, time spent, navigation paths
• Log Data: IP address, access times, error logs, crash reports
• Performance Data: load times, feature usage, diagnostics

This data helps us improve performance, security, and user experience.

2.3 Cookies and Similar Technologies

Cracy uses cookies, SDKs, pixels, and similar technologies to:

• Authenticate users
• Remember preferences
• Analyze traffic and usage
• Prevent fraud and abuse

You may control cookies through your device or browser settings; however, disabling them may limit functionality.

Media Access and Usage

Cracy may request access to your device's camera and photo library.

• Camera Access: Used only when you choose to record videos or capture photos for posts or campaigns within the app.
• Photo Library Access: Used only when you choose to select and upload photos or videos from your device.

Any media you upload may be stored on our servers and may be visible to other users based on your activity on the platform.

We do not access or collect media without your explicit action.

3. How We Use Information

We process information to operate, maintain, and improve Cracy. Processing may be automated or, where legally permitted, subject to limited human review.

Core Uses Include:

• Providing and maintaining accounts and features
• Personalising content, feeds, rankings, and recommendations
• Enabling campaigns, voting mechanisms, and community interactions
• Detecting abuse, fraud, spam, and security risks
• Conducting analytics, measurement, and business intelligence
• Research, development, testing, and innovation (including AI systems)
• Legal compliance and enforcement of policies

Cracy may use aggregated or anonymised data for the same purposes without limitation.

Analytics

We may use analytics tools to understand user behavior within the app to improve performance and user experience. This data is not used for tracking across third-party services.

4. Public Content, Campaigns, and Visibility

Cracy operates on a public-first model.

By using the Platform, you acknowledge that:

• Content, votes, campaigns, usernames, and influence metrics may be publicly visible
• Other users may interact with, share, or campaign for your content
• Visibility, reach, and outcomes are not guaranteed

Cracy does not control, endorse, or guarantee user interactions or outcomes.

5. Legal Bases for Processing

We process personal data under one or more of the following legal bases:

• Your consent
• Performance of a contract (providing the Platform)
• Compliance with legal obligations
• Legitimate interests (security, analytics, fraud prevention, platform improvement)

6. Data Sharing and Disclosure

We may share information:

6.1 With Service Providers

Trusted third-party vendors assisting with:

• Cloud hosting
• Analytics
• Notifications
• Content moderation
• Payment processing (if applicable)

All providers are contractually bound to protect your data.

6.2 For Legal and Safety Reasons

We may disclose information if required to:

• Comply with laws, regulations, or legal processes
• Enforce our Terms or policies
• Protect rights, safety, or property of Cracy, users, or the public
• Investigate fraud, abuse, or security incidents

6.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of assets, user data may be transferred subject to this Privacy Policy.

6.4 No Tracking

We do not track users across third-party apps or websites, and we do not use personal data for advertising or data broker purposes.

7. User Responsibilities and Accountability

By using Cracy, you agree that:

• You will not upload content you do not have the legal right to share
• You are responsible for any personal data you disclose publicly
• You will respect others' privacy and data rights
• You will not misuse data accessed through the Platform
• You understand that deleted content may persist in backups or legal archives

Cracy is not responsible for information you voluntarily make public.

8. Data Retention

We retain information only for as long as reasonably necessary, determined on a case-by-case basis, considering:

• Whether data is required to operate or provide the Platform
• Feature-specific retention logic
• Legal and regulatory obligations
• Safety, integrity, dispute resolution, and enforcement needs

Some data may be retained longer where required by law or to protect Cracy's legal interests.

9. Security Measures

We implement industry-standard safeguards, including:

• Encryption in transit and at rest
• Access controls and authentication
• Monitoring and abuse detection
• Secure infrastructure and audits

Login Activity and Security

We may collect login-related information such as device type, IP address, and timestamps for security and fraud prevention purposes.

However, no system is 100% secure. You use the Platform at your own risk.

10. Your Rights and Choices

Depending on your jurisdiction, you may have the right to:

• Access your personal data
• Correct inaccurate data
• Delete your account and data
• Object to or restrict processing
• Withdraw consent
• Request data portability

Requests can be made via in-app settings or support channels. Verification may be required.

11. Account Deletion

• Users can delete their account at any time from within the app settings (or equivalent account controls on the Platform).
• Upon account deletion, personal data (including sensitive data such as date of birth and sexual orientation where you provided them) and associated profile and user-generated content are permanently removed from our active systems.
• Any data retained after deletion is kept only where required by law or has been irreversibly anonymised or aggregated so it can no longer identify you.

Where retention is required by law (for example, limited records for tax, fraud prevention, or legal process), such information is kept only for the period and purposes permitted by applicable law.

12. Children's Privacy

Cracy is not intended for users under the age of 13 (or higher age where required by law).

We do not knowingly collect data from children. If such data is identified, it will be deleted promptly.

13. International Data Transfers

Your data may be processed and stored in countries other than your own. We ensure appropriate safeguards are in place for cross-border transfers.

14. Third-Party Links and Integrations

Cracy may contain links or integrations with third-party services. We are not responsible for their privacy practices. Review their policies independently.

15. Updates, Modifications, and Amendments to This Privacy Policy

Cracy reserves the absolute and unconditional right to update, modify, amend, replace, or revise this Privacy Policy at any time, with or without prior notice, to the maximum extent permitted by applicable law.

Changes may be made due to, including but not limited to:

• Legal or regulatory updates
• Changes in platform features, technology, or business models
• Security, risk, or compliance requirements
• Operational or structural reasons

Where required by law, Cracy may provide notice of material changes through the Platform or other reasonable means. Continued access or use of the Platform after any update becomes effective constitutes full acceptance of the revised Privacy Policy.

If you do not agree with any updated version, your sole remedy is to discontinue use of the Platform.

16. Contact Information

For questions, concerns, or requests regarding this Privacy Policy, contact:

Cracy Platform – Privacy & Compliance Team

Email: privacy@cracy.com

17. India-Specific Compliance (Information Technology Act, 2000 & DPDP Act, 2023)

This section applies to users located in India and is intended to ensure compliance with the Information Technology Act, 2000, associated IT Rules, and the Digital Personal Data Protection Act, 2023 (DPDP Act).

17.1 Role of Cracy as Data Fiduciary

Under the DPDP Act, Cracy acts as a Data Fiduciary only to the limited extent necessary to provide its services. Cracy does not determine the purpose of user-generated content, campaigns, votes, or communications beyond providing a neutral technological platform.

Cracy shall not be considered a publisher, editor, controller, or guarantor of user content.

17.2 User as Data Principal & Primary Controller

You acknowledge and agree that:

• You are the Data Principal for personal data you provide
• You are solely responsible for obtaining consent from any third party whose data you upload
• You act as the primary controller of any personal or sensitive personal data shared through your content

Cracy bears no liability for unauthorized, unlawful, or excessive disclosure by users.

17.3 Reasonable Security Practices

Cracy implements reasonable security safeguards as required under Indian law. However:

• Absolute security is not guaranteed
• Cracy is not liable for breaches beyond its reasonable control
• User negligence, compromised credentials, or third-party actions remain the user's responsibility

17.4 Grievance Redressal

In accordance with Indian law, users may raise grievances via the contact details above. Cracy's role is limited to procedural review and statutory compliance.

18. GDPR Annexure (European Economic Area & UK)

This annexure applies only where the General Data Protection Regulation (GDPR) is applicable.

18.1 Lawful Bases

Processing is based on:

• User consent
• Contractual necessity
• Legitimate interests (platform security, fraud prevention, analytics)

18.2 Data Controller Clarification

For user-generated content, Cracy acts as a data processor or intermediary, not a primary data controller. Users remain responsible for lawfulness, accuracy, and proportionality of content shared.

18.3 Data Subject Rights

GDPR rights may be exercised subject to:

• Verification of identity
• Technical feasibility
• Legal and contractual obligations

Cracy may refuse requests that are manifestly unfounded, excessive, abusive, or technically disproportionate.

18.4 Limitation of Liability

Cracy shall not be liable for:

• Public dissemination initiated by users
• Lawful processing based on user instructions
• Third-party access outside Cracy's reasonable control

19. CCPA / CPRA Annexure (California, USA)

This annexure applies to California residents under the California Consumer Privacy Act (CCPA) and CPRA.

19.1 No Sale of Personal Information

Cracy does not sell personal information as defined under CCPA.

19.2 Consumer Rights

Users may request access or deletion of personal information, subject to:

• Legal exceptions
• Security requirements
• Platform integrity considerations

19.3 Business Role Limitation

Cracy acts as a service provider / intermediary and is not responsible for user disclosures or downstream use by third parties.

20. Intermediary Status & Safe Harbour

Cracy operates strictly as a technology intermediary under applicable laws, including Section 79 of the IT Act.

Accordingly:

• Cracy does not initiate transmissions
• Cracy does not select recipients
• Cracy does not modify information

Cracy retains safe-harbour protection to the fullest extent permitted by law.

21. Absolute Limitation of Liability

To the maximum extent permitted by law:

• Cracy bears no responsibility for user-generated content
• Cracy is not liable for campaigns, votes, rankings, influence metrics, or outcomes
• Cracy is not liable for public disclosure initiated by users
• Cracy disclaims all warranties, express or implied
• Users expressly assume all risks associated with platform use

If liability cannot be excluded, it shall be limited to the minimum amount permitted by law.

22. Self-Looping Interpretation & Severability

This Privacy Policy:

• Must be interpreted together with Cracy's other policies
• Shall always favor intermediary protection and platform neutrality
• Shall not create fiduciary, publisher, or supervisory duties

If any provision is found unenforceable, the remaining provisions shall remain valid and enforceable.

23. Final Acknowledgement

By using Cracy, you explicitly acknowledge that:

• You understand the public-first nature of the platform
• You accept full responsibility for your data and actions
• You release Cracy from liability to the fullest extent allowed by law

Continued use constitutes unconditional acceptance of this Privacy Policy.

Contact Us

If you have any questions about this Privacy Policy, contact us at:

support@cracy.social